Dynamic Traffic Detection and Modeling for Beidou Satellite Networks

Beidou navigation system (BDS) has been developed as an integrated system. The third BDS, BSD-3, will be capable of providing not only global positioning and navigation but also data communication. When the volume of data transmitted through BDS-3 continues to increase, BDS-3 will encounter network traffic congestion, unbalanced resource usage, or security attacks as terrestrial networks. The network traffic monitoring is essential for automatic management and safety assurance of BDS-3. A dynamic traffic detection method including traffic prediction by Long Short-Term Memory (LSTM) and a dynamically adjusting polling strategy is proposed to unevenly sample the traffic of each link. A distributed traffic detection architecture is designed for collection of the detected traffic and its related temporal and spatial information with low delay. A time-varying graph (TVG) model is introduced to represent the dynamic topology, the time-varying link, and its traffic. The BDS-3 network is simulated by STK. The WIDE dataset is used to simulate the traffic between the satellite and ground station. Simulation results show that the dynamic traffic detection method can follow the variation of the traffic of each link with uneven sampling. The detected traffic can be transmitted to the ground station in near real time through the distributed traffic detection architecture. The traffic and its related information are stored by using Neo4j in terms of the TVG model. The nodes, edges, and traffic of BDS-3 can be quickly queried through Neo4j. The presented dynamic traffic detection and representation schemes will support BDS-3 to establish automatic management and security system and develop business.


Introduction
Beidou is one of the most rapidly developing global navigation satellite systems (GNSS). China's Beidou navigation system has evolved from BDS-1, then BDS-2, to now BDS-3 in built [1]. The position precision of BDS has been improved rapidly, and its coverage of navigation services has also been expanded from Asian-Pacific regions to worldwide [2]. Besides navigation and positioning, BDS has also provided a short message communication [3,4]. The short message communication has been demonstrated as an effective communication method in the area where the ground communication facilities did not cover or could not work. The inconstruction BDS-3 has been equipped with the intersatellite link (ISL) in Ka-band and laser [5]. BDS will be an integrated satellite network which provides not only the fundamental positioning, navigation, and timing services but also short message communication and future wide-band multimedia communication [1]. A variety of application data will be transferred by BDS. BDS will encounter the problem of network traffic congestion when more communication services are uploaded to it and transferred by it. Dynamic traffic control is essential to secure BDS and enhance its resource utilization. Traffic monitoring and representation are two important mechanisms to realize dynamic traffic management and control. Compared with terrestrial networks, BDS has a dynamic topology and is operated automatically. The problem arises as to how to monitor and represent the traffic of BDS so that the network traffic can be captured in time. Our research focuses on the traffic monitoring of BDS-3 for business expansion.
BDS-3 is a hierarchical space network that is composed of 3 geostationary orbit (GEO) satellites, 3 inclined geosynchronous orbit (IGSO) satellites, 24 medium earth orbit (MEO) satellites, some additional satellites in orbit for backups or tests, and ground stations [1]. The ground stations consist network has limited on-board processing ability and storage and that the hardware is hard to supplement, SNMP is utilized to collect and organize the information about network devices and links of BDS-3. Under SNMP architecture, the traffic detection architecture of BDS-3 and the polling strategy are two key points for the traffic measurement in terms of active monitoring mode.
The distributed detection architecture is utilized for automatic traffic detection under SNMP. Previous studies about satellite network routing have shown that the dynamic grouping strategy is better than the fixed strategy in the changing satellite constellations [10]. Under the dynamic group strategy, the satellites are grouped, and the group managers are selected according to the characteristics of the specific satellite network topology [9,[11][12][13][14]. The group managers are in charge of controlling, gathering, and distributing information to group members. We design the distributed traffic detection architecture for BDS-3 according to the satellite orbits and visible time to the ground station.
There are two polling strategies to detect the traffic of a link, fixed-period polling and dynamic polling. The advantage of fixed-period polling is easy control and operation. However, it may result in waste of communication and storage resources, and low efficiency [15]. Under the dynamic polling strategy, the next polling interval is adjusted based on previous detected data. The dynamic polling strategy consists of two steps, traffic prediction and polling period adjustment. In the traffic prediction, the detected historical traffic data are used to predict the traffic of the next time point. The next polling period is adjusted based on the variation of traffic values in terms of the polling period adjustment strategy. The dynamic polling strategy can minimize the interference to the communication of links and reduce the cost of wireless transmission and storage.
The prediction algorithms commonly used in the polling dynamic strategies of terrestrial networks are statistical analysis methods, such as the linear regression model [16] and Markov chains [17,18], and machine learning methods such as SVR (Support Vector Regression) [15]. The proposed traffic prediction algorithms are mainly ARMA (Autoregressive Moving Average) [19] and neural networks that include BPNN (Back Propagation Neural Network), RFBNN (Radial Basis Function Neural Network) [20], ESN (Echo State Network) [21], RNN (Recurrent Neural Network) [22], and LSTM [23]. Because the traffic detection algorithm should run on satellite systems, we choose the prediction algorithm in consideration of both the ability of computation and storage of satellite systems and the accuracy of prediction.
The polling period adjustment strategy determines how to adjust the next polling period if the predicted variation exceeds the thresholds [15,16,24]. The dynamic polling strategy makes the time at which the traffic is detected different from one link to another. A time alignment algorithm should be applied to synchronize the traffic of different links in order to compute the whole network traffic at specified intervals. The widely used time alignment methods are Lagrange interpolation, piecewise linear interpolation, and cubic spline interpolation.
The changing topology and the varying traffic of BDS-3 can be modeled by a time-varying graph (TVG) [25,26]. TVG was developed from a static graph that was largely used to model network entities and their relations in the form of vertices and edges. TVG maps states of the graph at different times. TVGs have three mapping approaches, namely, the snapshot, the log file, and the whole-graph method, respectively. In the snapshot method, each graph snapshot is a static representation of a network at a time point. The log file method is a modified snapshot method whereby each historical snapshot with a timestamp is recorded and stored in a log file. The whole-graph method records each kind of network elements (i.e., vertex, edge, or attribute) with a valid time point or a valid time interval. After analyzing the three kinds of TVGs and the characteristics of BDS-3, we choose the whole-graph method to model the dynamic BDS-3. With the BDS-3 TVG model, the detected traffic of links and the corresponding network topology can be stored. The whole network traffic and its evolution can be derived. The TVG information is essential for BDS-3 management and traffic load balancing. This paper focuses on the network traffic monitoring, collection, and representation with the aim of detecting and storing the network traffic of BDS-3 in time. It has three contributions. The first one is that a dynamic traffic polling scheme is proposed for detecting the traffic of a link. The second is that a TVG in terms of the whole-graph method is used to model the dynamic satellites, the topology, and the traffic of BDS-3. The third is that a distributed network traffic detection architecture in terms of SNMP was introduced for BDS-3.

Journal of Sensors
The rest of this paper is organized as follows. In section 2, the methodology for network traffic detection, collection, and representation of BDS-3 is introduced. The methodology includes a dynamic traffic polling scheme, a distributed traffic detection architecture and a time-varying graph model. The simulation scenarios and their results are shown in section 3. The conclusion of our work is in section 4.

The Dynamic Traffic Detection,
Representation, and Collection for BDS-3 The network traffic detection, representation, and collection framework are proposed based on the satellites, their orbits, and functions in BDS-3. GEO and IGSO satellites function not only as navigation systems but also as relays which forward space-based measurement and control information [6,27]. Because the inclined orbit angle of IGSO is more than 0°, it is visible at high-latitude area. IGSO is more favorable than GEO for the MEO information relaying [27] in the designed distributed traffic detection architecture.
2.1. The Dynamic Traffic Polling Scheme. The dynamic polling scheme consists of two parts: (1) the data prediction algorithm and (2) the polling period adjusting strategy [15][16][17][18]. The block diagram of our dynamic polling scheme is depicted as Figure 1.
where s i ðtÞ is a determined polynomial on each subinterval as The value of a i , b i , c i , d i is uniquely determined based on the property of interpolation continuity, differential continuity, and natural boundary conditions.
The time series x = f xðt 1 Þ, xðt 2 Þ,⋯, xðt n Þg is inputted to the trained LSTM model in order to predict the value of the next time point t n+1 = t n + T s . Then, the LSTM model outputs the predicted next traffic value b x = ðt n+1 Þ.
We used historical traffic to train a LSTM model, and then utilized the trained model to predict traffic. LSTM is acknowledged as the state-of-art prediction model for time series prediction [28]. Our LSTM model consists of one recurrent hidden layer and one output layer. The block diagram of our LSTM model is shown in Figure 2.
The basic unit of the hidden layer is the LSTM neuron [29] which consists of one memory cell, one input gate, one output gate, one forget gate, and three adaptive and multiplicative blocks. The structure of an LSTM neuron is shown in Figure 3.
The memory cell c t acts as an accumulator of the state information [30]. The input gate i t and the output gate o t control the input and output activations of the memory block, respectively. The forget gate f t controls whether the past memory cell c t−1 is propagated to the current memory cell c t . Assume the input of the model is fx 1 , x 2 ,⋯,x t g, where x t is a time series which is a slice of the evenly spaced detected traffic time series x = f xðt t Þ, xðt t+1 Þ,⋯, xðt t+k Þg introduced previously. The equations of the LSTM neuron are listed as follows: where σð·Þ and tanh(·) represent the sigmoid function and hyperbolic tangent activation function, respectively. W represents weight matrices, and b represents bias vectors. The symbol * denotes the Hadamard product. The output layer is a dense layer to make a single value prediction. The output h t of the hidden layer is propagated to the output layer, and then, the predicted trafficŷ t is obtained. During the process of dynamic polling, the parameters of the LSTM model are fine-tuned by the k latest traffic training samples. The training samples are interpolated from the real traffic series detected in the most recent period of time.

Dynamic
Polling Period Adjusting Strategy. The next polling period is adjusted dynamically according to the variation of traffic. The period is extended if the variation is low, while the period is shortened if the variation is high.

Journal of Sensors
The rate of traffic change is decided by the latest detected traffic, and the next predicted traffic obtained by LSTM: Assume the maximum period is T max , and the minimum period is T min . The maximum period is set to assure that the detector can poll at least once in the connection time of links, so T max is set less than the minimum link duration of BDS. The minimum period assures that the polling does not take much network resources, so T min is usually set to few seconds [17]. The adjusting factor ε is a number greater than one, which determines the adjusting step size. The upper threshold is U max , and the lower threshold is U min . The polling cycle of the next polling T n+1 is determined by the following procedures.
(i) Input the last k interpolated traffic values x = f x ðt n−k+1 Þ, xðt n−k+2 Þ,⋯, xðt n Þg to LSTM to get the predicted value b xðt n+1 Þ of the next time point t n+1 = t n + T s . Then calculate the rate of change δ by Equation (5) (ii) Adjust the polling cycle according to ε.  Figure 4. Therefore, in order to calculate the total network traffic, we should align the timing-mismatched traffic sampling points to the same time points.
Considering that we want to get the total network traffic at time t, we align the traffic of each link by means of linear interpolation. Assume that the detected traffic of link j is x j = fx j ðt 1 Þ, x j ðt 2 Þ, x j ðt N j Þg. The stepwise linear interpolation function S j ðtÞ meets the conditions: where s ji ðtÞ is a determined polynomial on each subinterval by After obtaining the interpolation curve of each link, the total network traffic at any time t is computed by  ...
Hidden layer Output layer  Journal of Sensors Figure 5 shows the distributed detection architecture and the message transmission direction. The agent satellites are allocated to detector satellites in terms of the shortest route principle. The detection mechanism under the distributed detection architecture is described as follows. To begin with, the detector satellites, respectively, send request messages to the agent satellites in their coverage. Then, the agent satellite responds messages containing traffic information to the detector satellites. Next, the detector satellites forward the collected information to the ground station. The detector satellites can exchange their collected information if needed.
Under the distributed traffic detection architecture, the tasks of agent satellites' monitoring, traffic collection, and management are assigned to different IGSO satellites, so that the whole network operation states can be detected in near real time.

The Time-Varying Graph for a Satellite Network.
We applied TVGs to describe a dynamic satellite network and its traffic. A graph model is designed to depict the topology, node and link attributes, and traffic that change over time.
The changes of network topology and links are periodical and discrete, so finite periodic snapshots are applied to describe them. The change of link traffic is continuous, so an ever-extending time series are applied to depict it. The time-varying graph of a satellite network is expressed as G = ðV, E, S, ΓÞ, which has the following components. In one period time of T, the graph is depicted by several slices which are cut off according to the change rules of the satellite network. The several slices in a period are expressed as a slice time series, GðV, E, ΓÞ = fGðV, E, Γ 1 Þ, GðV, E, Γ 2 Þ,⋯,GðV, E, Γ n Þg, where Γ 1 = ½t 1 , t 2 Þ, Γ 2 = ½t 2 , t 3 Þ, ⋯, Γ n = ½t n , t n+1 Þ, where Γ 1 ∩ Γ 2 ∩ ⋯ ∩ Γ n = ⊖ , and Γ 1 ∪ Γ 2 ∪⋯∪Γ n = T. So, the snapshot of the topology of satellite network at any time point t is GðV, E, tÞ = GðT, E, t + TÞ. G ðV, E, S, ΓÞ describes the global information of network topology and total traffic. The detailed information of each node and edge is introduced in the following context.
The attribute set of nodes is expressed as F V = ðp, l, Γ i Þ, which has the following components: (i) pðc, tÞ → f0, 1g: called node presence function, which indicates whether a given satellite or ground After establishing the time-varying graph for a dynamic satellite network, the information of the satellite network can be well expressed. The snapshot of the network at any given time can be obtained, as well as the topology, link con-nectivity, link latency, and link traffic. Figure 6 shows an example of the TVG model of a satellite network, where satA, satB, and satC represents three MEOs, respectively.

Simulation Scenario Establishment.
We established simulation scenarios by using STK (Satellite Tool Kit) tools. We simulated the dual-layer satellite network that was composed of 24 MEOs in standard Walker constellation 24/3/1, 3 IGSOs with phase difference of 120°, and 3 ground stations in China [5,27]. The simulated constellation structure of the satellite network is shown in Figure 7.
The visibility between all the satellites and the ground station in Sanya is shown in Figure 8. As shown in Figure 8, the IGSO satellites keep links with the ground station, while the MEO satellites intermittently connect with the ground station. In our distributed traffic detection framework, the 3 IGSO satellites were designed as the detectors. The 24 MEO satellites were dynamically assigned to one of the 3 detectors according to Dijkstra's shortest path principle. Most of its orbit cycle time, a MEO satellite could find an IGSO satellite to relay the data to the ground station. If the   Under the distributed traffic detection architecture that we presented, the total connectivity time between the MEO 03 and Sanya station through IGSO satellite relay is 82 h. Our distributed traffic detection framework reduces the interval to obtain the traffic of whole links because the time spent on the traffic detection of each link is largely shortened.
The link length l link can be obtained through STK analysis of the established simulation scenarios. The link latency t link is calculated as where c represents the velocity of transmission. The latency spent on transmitting request messages or traffic response messages in the process of traffic detection can be calculated according to the result of Equation (9).

Results of Dynamic Traffic Detection.
Assume the satellite-ground link is a laser link with a 150 Mbps rate [31]. In order to test the dynamic traffic detection method, we used the WIDE traffic dataset in the period between 2009/03/30, 00 : 00 and 09 : 00 as the traffic of the link between an IGSO satellite and a ground station. The average rate of this dataset is 92 Mbps, which is less than 150 Mbps. So, the WIDE dataset was considered a reasonable virtual traffic of the detector-ground links. We cut the WIDE dataset into several slices to represent the traffic of three detectorground links. In the dynamic polling period adjusting strategy, the minimum polling period was set as 15 s in order to save network resources. So, the time resolution of the detected traffic time series is 15 s. Figure 9 shows the traffic sampling points and the traffic detection values of three simulated detector-ground links.
Assuming that the sampling number is N, the predicted traffic value of every polling round is expressed as fŷðt 1 Þ,ŷ ðt 2 Þ,⋯,ŷðt n Þg, the corresponding real traffic value is fyðt 1 Þ, yðt 2 Þ,⋯,yðt n Þg. The relative root mean square error (RRMSE) defined in Equation (10) is utilized to measure the prediction performance of LSTM.    Figure 11: Results of total traffic estimation. Because the number of neurons in the hidden layer of the LSTM model can influence the prediction performance, experiments were conducted to determine the number of neurons of the dynamic traffic polling. As illustrated in Figure 10, the descent speed of RRMSE is fast before 30 neurons and is slow even fluctuant after 30 neurons. The more neurons, the more is the complexity and computation cost. So, we chose a 30-neuron hidden layer for the tradeoff between performance and complexity.
The traffic prediction performance of LSTM was compared with ARMA (2,1) [32] which is a conventional traffic prediction method used in satellite networks. Considering the limited on-board computational power and storage, the CPU usage and memory usage of the dynamic traffic polling schemes using different prediction methods were also compared. The experiments run on a personal computer with Intel Core i54570 (3.20 GHz), 16 GB, 64-bit operating system Windows 10. The prediction performances of ARMA and LSTM are shown in Table 1. LSTM has less RRMSE than ARMA in traffic prediction. LSTM improves the accuracy of traffic prediction. The CPU usage and memory usage of dynamic traffic polling using ARMA and LSTM are, respectively, shown in Table 2. The dynamic traffic polling scheme with LSTM has a little less memory consumption and a little more CPU usage than that with ARMA. We found that LSTM has been used in the satellite system for on-board task planning [33], which means the on-board computing resources can support for running LSTM. So, after a systematic consideration, LSTM instead of ARMA was chosen in traffic prediction of satellite links.
After dynamic traffic polling, the whole traffic that included the 3 links were estimated. The three timemismatching detected traffic series were aligned by linear interpolation.
We estimated the total traffic per 15 s according to the time resolution of 15 s. The results of the total 3-link traffic are shown in Figure 11. In Figure 11, the estimated total traffic curve is similar to the real summed traffic curve.
RRMSE between the estimated total traffic curve and the real total traffic curve is computed to evaluate the estimation performance. We also tried another two interpolation methods, nearest and cubic spline, in the procedure of total traffic computation. The performance of total traffic estimation is listed in Table 3. It can be seen from Table 3 that there is little difference among the linear, nearest, and cubic spline methods. This reason may be that the estimation results mainly depend on the sampling series and they are not sensitive to the alignment method. Therefore, linear interpolation is chosen in order to save the calculation cost.

TVG Database.
When the detected traffic and its related information, such as node and link attributes, and timestamps are transmitted to the ground stations, they are organized in terms of the introduced TVG model. We chose a graph database, Neo4j, to store the information of the TVG model of the simulated satellite network. We can query the information of a satellite or a link from the Neo4j database. We can also snapshot the traffic of the whole satellite network at a given time. One snapshot of a part of the satellite network is shown in Figure 12. The attributes and traffic information of the link highlighted in yellow are shown at the bottom of Figure 12. The information of the TVG model for BDS-3 can be well stored in the Neo4j database. The database supports quick query of the nodes, edges, and traffic in the BDS-3 system. Neo4j will be an efficient tool for BDS-3 management.

Conclusion
BDS-3 is being established as a GNSS. It is not only responsible for positioning and navigation but also for message communication and further data transmission. Traffic detection and representation are basic techniques for automatic management and control of BDS-3 with the aim of ensuring safety operation. Under the SNMP protocol, a dynamic traffic detection method including traffic prediction by LSTM and a polling adjusting strategy was proposed for detecting the traffic of each link in BDS-3. A distributed traffic detection architecture was also established to collect the traffic and its related information in near real time. A TVG model was introduced to represent the dynamic topology and the traffic of each link at specific times. We used STK to simulate MEO-B6  MEO-A5   IGSO-2 IGSO-1 IGSO-3

MEO-C5
User-2 User-1 User-3 Groundstation the BDS-3 and the WIDE dataset to simulate the traffic between IGSO satellites and the ground station. Simulation results show that our traffic detection method can track the variation of the traffic with nonuniform sampling and the detection error is low. The distributed traffic detection architecture avoids the influence of intermittence that is caused by characteristics of BDS-3 and shortens the time of information transmission from satellites to the ground station. Neo4j is utilized to store the obtained data that are organized by the TVG model, which results in quick query and the computation of the traffic of the whole satellite network. Our work will support BDS-3 to realize automatic management, security establishment, and business expansion.

Data Availability
The . These prior studies (and datasets) are cited at relevant places within the text as references [5,27].

Conflicts of Interest
The authors declare that they have no conflicts of interest.